Distilling Language Models: Can You Prove Knowledge Theft Through a Chat?

A conflict is brewing in the world of large language models that resembles the patent wars in pharmaceuticals, except that instead of molecules, what gets stolen is knowledge packed into billions of parameters. A recent study published on Habr poses a provocative question: can you determine, simply by chatting with a language model, that it was trained by distillation on another model's outputs? The author believes you can. And if he is right, it changes the rules of the game for the whole industry.

To understand the context, we need to go back to a scandal that erupted several months earlier. Anthropic, the maker of Claude, publicly accused Chinese developers of systematically distilling its model. The claim was that engineers from China made mass use of the Claude API, collecting its answers to train their own models. Anthropic said it detected this by monitoring accounts: analyzing request patterns, usage history and links between accounts and Chinese companies. The evidence was built at the infrastructure level: who sent how many requests, and when.

But the study's author took a completely different path. He asked: what if the evidence is hidden not in server logs but in the model itself? Distillation is a process in which a small student model is trained to reproduce the behavior of a large teacher model. In essence, it is knowledge compression: instead of training a model on terabytes of raw data, the developer feeds it ready-made answers from a more powerful system. The student model picks up not only facts but also the teacher's stylistic quirks, chains of reasoning, characteristic turns of phrase and even mistakes. These traces, a kind of "fingerprints," are what the researcher tried to detect through the model's so-called self-report.

The method looks elegant in its simplicity. If a model was trained on Claude's answers, it may involuntarily reproduce patterns characteristic of Claude: specific refusal wording, a recognizable reasoning structure, certain ethical frameworks that Anthropic builds into its product. It is like a linguist who can tell from speech peculiarities which region a person grew up in, except here we are talking about a neural network's "training region." The author says he found such markers, though he makes an important caveat: the results are tentative and cannot serve as legal evidence.

This caveat is not mere politeness but reflects a fundamental problem. Language models remain largely black boxes even to their creators. No one can say with absolute certainty why a model produced a particular answer. A match in stylistic patterns may result from distillation, or from training on similar data from open sources. Two models trained on the same scientific papers and books will inevitably resemble each other, and that has nothing to do with intellectual property theft.

Nevertheless, the direction of the research is extremely promising. The industry badly needs tools to verify where models come from. Today the market is flooded with open-source models, many of which perform suspiciously well on tasks that theoretically require significantly greater computing resources. If methods of "linguistic forensics" for neural networks are refined, they could become the basis for a new field: AI forensics, digital criminalistics for artificial intelligence.

For large labs such as OpenAI, Anthropic and Google DeepMind, the stakes are enormous. Training frontier models costs hundreds of millions of dollars, and if competitors can get comparable quality through distillation for a small fraction of that cost, the entire economic model collapses. It is no accident that the terms of service of most major providers already explicitly prohibit using outputs to train competing models. But a ban without a mechanism for detecting violations is just words on paper.

The study, for all its preliminary nature, points to a future in which models carry indelible traces of their origin. Perhaps, in time, developers will begin deliberately embedding hidden watermarks in their models: unique response patterns that cannot be removed during distillation. Some companies are already experimenting with such techniques. If these methods become reliable, the AI development world will get what it critically lacks right now: an accountability mechanism. Until then, the industry balances on a thin line between open exchange of knowledge and protection of investment, and that line gets thinner every month.